v0.7.0 — Structure bar + Event Bus + SPA/QR

AAAX v0.7.0

Identity you run. Signals you own.

Highlights

• Layer-first packages (qs/uaa neat): endpoint/ · usecase/ · entity/po|model|dto
• AuditEntity + @Version / createDt · BaseResponseDto · *RequestDto/*ResponseDto
• Event Bus catalog v1.0 · HMAC webhook · mesh compose
• SPA PKCE (aaax-spa) · QR + Redis stores · trusted devices

Try

git clone https://github.com/yky32/aaax.git && cd aaax
git checkout v0.7.0
mvn test && mvn spring-boot:run

Docs: booklet · CONTRIBUTING

AAAX v0.6.0

Changelog

All notable changes to AAAX are documented here.

[0.7.0-SNAPSHOT] — unreleased

Development follows v0.6.0.

[0.6.0] — 2026-08-21

Highlights

• QR code login — desktop QR / code, phone approve, consume
• Trusted devices — AAAX_DEVICE cookie, optional TOTP skip
• com.aaax.core foundation — AuditableEntity, BizException, Ids
• HTTP *Endpoint naming (not Controller)
• Event Bus P1 — catalog v1.0, webhook HMAC + retry, audit eventId
• Docs — single SoT docs/booklet.md
• Mesh golden path — examples/compose-mesh/ (Postgres + Redis + Kafka + signed webhook)
• CI green (enforcer + Central-only checks)

Event Bus

• GET /v1/admin/events/catalog
• dataschema, data.eventId, data.catalogVersion
• AAAX_EVENTS_WEBHOOK_SECRET → X-AAAX-Signature: sha256=…
• Delivery id headers + retries on 408/429/5xx

Auth / UX

• /sign-in/ QR tab · /v1/auth/qr/*
• Remember device checkbox · /v1/devices
• Passkeys still opt-in (AAAX_PASSKEYS_ENABLED) with webauthn4j

[0.5.0] — 2026-08-21

Highlights

• UseCase application layer (no GodService)
• Pluggable OTP/magic store — memory | redis
• FinishAuthenticatedSession unified login finish
• Passkeys webauthn4j (opt-in, off by default)
• Resource-server Boot 4 example
• Identity Event Bus E2E · SMS dual-mode · SAML SP · Google/GitHub social
• Hosted /sign-in /sign-up /user · admin portal

AAAX v0.5.0

Changelog

All notable changes to AAAX are documented here.

[0.6.0-SNAPSHOT] — unreleased

Development follows v0.5.0.

[0.5.0] — 2026-08-21

Highlights

• UseCase application layer (no GodService)
• Pluggable OTP/magic store — memory (default) | redis
• All logins → FinishAuthenticatedSession (password/OTP/magic/social/SAML/passkey)
• Resource server example — Boot 4.1 JWT RS (examples/resource-server-boot4/)
• Passkeys — webauthn4j registration + assertion verify; off by default (AAAX_PASSKEYS_ENABLED)
• OSS tour: CODEMAP, mermaid Event Bus path, overnight A–D polish

Supported

• OIDC AS, accounts, password, OTP, magic link, TOTP MFA, sessions
• Identity Event Bus (log/audit/buffer/Kafka/webhook)
• Hosted /sign-in /sign-up /user /admin
• Google/GitHub social (opt), SAML SP (opt)
• SMS dual-mode (Kafka | webhook)

Opt-in

• Passkeys when aaax.passkeys.enabled=true (webauthn4j verified; RP/origin must match)
• Redis OTP store when aaax.otp.store=redis

Out of 0.5

• Multi-tenant orgs, SAML IdP, official React SDK, LDAP

[0.4.0] — 2026-08-20

Event Bus wedge + hosted experiences + Kafka notify example. See git tag v0.4.0.

v0.4.0

AAAX v0.4.0

Identity you run. Signals you own.

Primary

• Identity Event Bus → Kafka / webhook / your notification-service
• OIDC AS · Boot 4.1 / JDK 21
• Hosted /sign-in /sign-up /user · Admin /admin
• OTP/SMS without carrier lock-in (kafka | sms webhook)
• Magic link · sessions · TOTP · Google/GitHub social · SAML SP

Experimental

• Passkeys (not production MFA yet)

Try Kafka path

mvn -DskipTests package
cd examples/compose-kafka-notify && docker compose up --build

Docs: booklet · IDENTITY_EVENTS · CLERK_PARITY

v0.3.0 — Developer product

AAAX v0.3.0

Identity you run — standalone OIDC-grade auth for IT/developers.

Highlights

• Clone → Maven Central only → run (no private packages / app-core)
• Accounts, OTP (+ mail), OAuth clients admin, protected API sample
• Password forgot/reset, passwordless OTP login
• qs/uaa core parity matrix (honest gaps)
• examples/curl recipes + resource-server sketch
• Booklet as single docs source of truth

Quick start

git clone https://github.com/yky32/aaax.git && cd aaax
mvn test && mvn spring-boot:run
./examples/curl/get-token-and-hello.sh

Demo: demo / demo1234 · client aaax-demo / aaax-demo-secret

See CHANGELOG.md and docs/AAAX_BOOKLET.md.